HOW SOME LET'S ENCRYPT RENEWAL FAILURES POINTED TO AN AWS TRAFFIC HIJACKING ISSUE

Summary from the TLDR InfoSec newsletter

An AWS customer began to notice connectivity issues with Let's Encrypt renewals in a VPS that they used that they were not able to resolve with support from the VPS provider. After debugging with AWS, they discovered that the traffic was being routed to a third party that was advertising a typoed BGP route through Direct Connect that unintentionally overlapped with the original AWS customer's IP range. AWS support confirmed that its BGP route verification process failed in this circumstance and has added process improvements to prevent possible malicious traffic hijacking through this vector in the future.